Formalizing Policy-Modification Corrigibility — LessWrong